WordPress powers a very large share of the world’s websites, which also makes it a frequent target of automated attacks. The good news is that WordPress security doesn’t require magic: most problems are prevented with simple, consistent measures.

Below are the ten steps we apply to every site we maintain, in order of impact.

1. Update without delay

Core, plugins and theme should always be up to date. Security updates close known holes, and attackers’ automated tools look precisely for outdated versions. Ideally, updates are tested first on a copy of the site (staging).

2. Backups that actually work

A backup is only worth something if you can restore it. Make sure you have:

  • automatic backups of files and database,
  • storage away from the website’s server,
  • several older versions, not just the latest,
  • a restore test from time to time.

3. Strong, unique passwords

Every account needs a long, unique password that isn’t used anywhere else. A password manager makes this easy. Avoid accounts named “admin”.

4. Two-factor authentication

With two-factor authentication (2FA), even if someone learns your password, they also need a code from your phone. It is one of the most effective measures for administrator accounts.

5. The right user roles

Give each person only the role they need: an editor doesn’t need administrator rights. Remove accounts of former collaborators straight away.

6. Fewer, trustworthy plugins

Every plugin is code running on your site. Keep only what you need, from reputable developers who update regularly. Delete — don’t just deactivate — what you don’t use. Avoid “free” copies of paid plugins; they often contain malicious code.

7. Protect the login page

Limit failed login attempts to slow down password-guessing attacks, and turn on alerts for suspicious logins.

8. HTTPS and secure hosting

An SSL certificate encrypts data between visitor and site. Hosting matters just as much: an up-to-date PHP version, isolation between accounts and a server-level firewall.

9. Disable file editing in the dashboard

WordPress lets admins edit theme and plugin code from the dashboard. If someone gets in, that is an easy tool for them. Setting DISALLOW_FILE_EDIT in wp-config.php turns it off.

10. Monitoring and a response plan

A tool that watches for file changes, malicious code and downtime warns you early. And if something does happen, you should know the steps:

  1. change all passwords,
  2. restore from a clean backup,
  3. find and close the gap,
  4. check Google Search Console for security warnings.

Security means consistency

No site is completely untouchable, but with these measures it becomes a very hard target. The key is doing them regularly, not once. If you’d rather hand it over, M. Dimopoulos offers maintenance and support, including for websites built by others.